The Spam Problem: Moving Beyond RBLs 508
whirlycott writes "I just published a paper called The Spam Problem: Moving Beyond RBLs on my site. I comprehensively describe RBLs and list eight specific problems with them. I also get into ideas that next generation antispam system creators should read. I hope that this will be useful to anybody who is attending the Spam Conference at MIT on Jan 17th."
You know, that would suck. (Score:2, Informative)
I mean, you can compare it to having your entire town roped off because one person was a fraud... completely destroying said town, but you still live in it.
Wasting an entire netblock by blacklisting it is not good....
Re:You know, that would suck. (Score:2, Interesting)
If you are using an ISP that does not enforce acceptable use policies restricting unsolicited email, you are supporting spaming activity.
In the past, when just systems that were directly associated with spam were blocked, the ISPs would move the spammer to one of the unblocked ips, and move an innocent to the blocked ip. Turns into 'whack-a-mole'.
With most blocklists, the block starts out small, targeting just the spammer. If the ISP gets rid of the spammer, the block goes away. If the ISP ignores complaints, the block grows.
Re:You know, that would suck. (Score:3)
Um, exactly how much research are you expecting people to do on motels? Call them up and say "Can I order pizza there?"
"If you are using an ISP that does not enforce acceptable use policies restricting unsolicited email, you are supporting spaming activity."
As opposed to what? Exactly how is one supposed to go about finding out about how effective an ISP's attempts to filter spam are? The biggest problem with your argument is that spammers always change how they operate.
Sorry, but your answers struck me as oversimplified and unhelpful. How that was modded up as 'insightful' I'll never know.
Passive denial doesn't work (Score:3, Informative)
And, that's where the problems lie. Administrators are putting these things in, assuming they'll stop spam, and then getting pissy when you tell them legitimate mail isn't getting through.
I used to be the e-mail admin for my company. We somehow ended up on the worst of these lists, osirusoft. This, despite the fact that we used SMTP AUTH; YOU COULDN'T SEND MAIL WITHOUT A PASSWORD! And, once you get on one of the lists, you're on them all.
So, I spent the better part of a couple of days going through them all and having to prove I wasn't an open relay. They all but one removed us within a week, but that was a week we couldn't send mail to a few customers.
And, the one that didn't remove us in a week...osirusoft...they took over a month. Every day I went to their site and ran the "autotest". Every day I watched it say, "Relaying Denied, deleting from list". Every day, I watched another "proof" of our spamminess posted onto their list.
And, the idiot admins of the ISPs? "Well, you're obviously an open relay. I see dozens of spams being sent from your site on the osirusoft list!"
BTW, the osirusoft rbl is run by some loser in his basement. Great plan, basing your company's e-mail on some unemployed idiot with a chip on his shoulder.
Look at your spam, where does the majority come from? That's right, AOL & Hotmail. But, your company would NEVER allow you to block from them, they'd lose too many customers. Install an active filter, you'll see better results and less spam.
Easiest way to stop spam... (Score:3, Insightful)
Re:Easiest way to stop spam... (Score:2, Interesting)
Absolutely. Spread the message to new users. The response to spam is very small, on the order of hundredths of a percent. The spammers get negligible responses because of the sheer numbers of recipients. I can't help but think that it's mainly newbies that respond to spam; x amount of unwary sheep getting sheared the first time they see the opportunity to 'Meet lonely married people' or 'add inches to penis/bust/whatever'.
Re:Easiest way to stop spam... (Score:5, Insightful)
The problem is that you are in a global network. It is like the problem of eating whale meat, you can persuade 99.999% of the world population that eating whale meat is a bad idea but the other 0.0001% that is left can eat the endangered species to extinction within a matter of months.
It only takes a vanishingly small number of businesses out there to SPAM and you have a massive problem.
SPAM does not have to even be profitable for people to do it. If I wanted to launder a lot of drug cash I would set up a spam house and bombard people with ads for herbal viagra..
There was a time not so long ago when the majority of the SPAM being sent out was adverts for spam software. SPAM does not have to work as a marketing method for creeps to get rich charging others to spam. The pitch line they use to haul in suckers is 'it must work or why would people do it', well no, it does not have to get one single end customer for it to work for the spammer.
Wrong... (Score:3, Interesting)
And a "Stop Buying Spam Products" is doomed to fail, anyway, because it's a numbers game. If 1 person out of every 100 people spammed buys something, then it's probably an outrageously successful campaign.
The fact is, you may be throwing out 50 spam emails a day, but if you see a subject line that speaks to an immediate need, you're probably going to stop, read it, and consider a purchase.
Re:Wrong... (Score:2, Interesting)
Oh yeah? (Score:2, Funny)
It couldn't have been easier.
Re:Easiest way to stop spam... (Score:5, Interesting)
Not exactly. Besides being a theft of end-user and mail-site resources, spamming is also a scam perpetrated upon businesses. If you got spam advertising Joe's Naked Kinky Web Site, that probably isn't because Joe thought up the idea of spamming you all on his own. Most likely, a career spammer (let's call him Alan) convinced Joe that spamming was:
- effective,
- legal, and
- everyone's doing it anyway, so why miss out?
Joe then paid the career spammer to spam for his naked kinky Web site. Since all three of Alan's claims are false, and he knows it, this means that Alan has defrauded Joe. He exploited the fact that Joe is probably neither an Internet expert nor a lawyer, but he does feel competition from other naked kinky Web sites, to convince him to pay for spamming.(Yes, Alan the spammer told the news media that spamming is effective, too ... and they believed him. He was lying there, as well -- but it got him, and spamming, free advertisement in the news!)
This scam does not rely on spamming actually being effective, so long as vendors still believe it might get them an edge over the competition. Thus, getting people to quit buying spamvertised products cannot (directly) affect it. Only when all vendors on the Internet -- yes, including naked kinky Web sites -- realize that spamming doesn't work, isn't legal, and that they can do just as well without it, will spamming go away.
Re:Easiest way to stop spam... (Score:3, Insightful)
And did he publish a paper (Score:2)
Seriously, I'll try and review the paper...
Incomplete! (Score:3, Insightful)
How about this? (Score:2)
May I be rejecting legitimate e-mail if I block China.com? Absolutely. As a matter of fact I hope I do, I hope I block a whole bunch of them. Further, I'll tell them why.
"The network you're using sends an unacceptable amount of SPAM, there is a plethora of open relays and nothing is being done about it."
China.com admins may not give a rat's ass if I bitch and complain. But if their customer base goes ballistic because their service is unusable for this reason, then something may happen. The best solution? No, the best solution is to drag out and kill:
- Spammers
- Every idiot who's purchased herbal penis enlargement and HGH
IMHORe:Incomplete! (Score:5, Insightful)
But, you see, those things he's "pointing out" are wrong. They just aren't so. They aren't the way the world works, and they aren't the way DNSBLs work.
It is not mail users who want us to consider DNSBLs passe' or something to "move beyond". It is spammers who want us to give up our current most effective tool for collaborating to impede their crimes.
Preemptive methods (Score:5, Insightful)
1. Don't let a spammer verify your email address [thomsonville.com]
2. Don't post your email address on the internet [thomsonville.com]
3. Secure your email client [thomsonville.com]
4. Avoid common email traps [thomsonville.com]
5. Fight back [thomsonville.com]
Let me know if these can be improved.
Re:Preemptive methods (Score:2)
So... according to the webpage, the all the 5 tips are summarized as follows:
Please try the following:
Gee... many thanks Slashdot!
Re:Preemptive methods (Score:5, Insightful)
Not posting your address is important. If you you post your address on the internet, expect more than 10 spam a day. Similarly if you use it to post on usenet, expect more than that. It seems to be hardly sufficient, however.
I have decided that my only recourse is to change my address every time it starts getting spam. People that email me at an old address get a note saying why the address has been disabled and a url on my website where they can fill out a form to contact me. (btw, if you are interested, you can get the contact form that I use on my website [ostermiller.org], it is designed to thwart spammers, unlike formmail and other cgi to email gateways.)
Re:Preemptive methods (Score:3)
This works well, if someone sells my address, I just kill that alias.
But what happens is some idiot I know in real life will do exactly what you said above. Or just add me to their address book, and get infected with some virus which starts sending stuff out with my address. Or what ever, my address slips out.
So I go and kick them in the head, tell them how stupid they are.
I also run SpamAssassin, which does catch a lot of the stuff, so for the most part my inbox is pretty bareable.
Re:Preemptive methods (Score:2)
I opened a new account at bellsouth.net as a result of installing DSL at home, and was spammed the next day. Because my userid is four characters long, I presume that the spammers were using a permutation technique to develop addresses.
Sending spam is so cheap, they can afford to send stuff to *all* short email addresses, published or not.
You can guard against leaks in your best paranoid fashion -- but they'll find you.
Unfortunately, with so many government entities to deal with we will never have legal protection against spam. The low-lifes will simply move to more agreeable jurisdictions. Any long-term solution to the spam problem is therefore a technical issue. I predict that whitelists will become far more common in the next couple of years.
Re:Preemptive methods (Score:5, Insightful)
1. Don't let a spammer verify your email address
This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.
Additionally, the extremely low cost of spamming means that bogus addresses are a marginal problem at best. The spammer would rather take a chance that the email account is active and send the spam than not send it.
2. Don't post your email address on the internet
I learned this lesson too late. A Google search pulled up a dozen newsgroup messages with my email address in them. Nine were posted by me, and I asked Google to remove them. Unfortunately, 3 are by other people quoting me, and I have no recourse to remove them. Spammers will therefore have permanent access to my main email address.
Additionally, I have no control over emails that other people send that include my address. I hate "pass along" emails that certain people get and feel the need to send to everyone in their address book, but I can't help that a) my email address is included in a batch of 50 others, and b) it's a very convenient way for spammers to collect verified email addresses.
3. Secure your email client
By this I assume you mean using client-level filtering. I do. Alot. I typically get about 60-80 pieces of spam a day, and have set up 30 or so filters. But that only catches about 2/3's.
Simply put, there is no client-level filtering solution that is going to work 100% of the time.
4. Avoid common email traps
I assume here that you mean things like "posting to newsgroups". You can only avoid traps that you already know about, and most people don't know about them.
Besides, why should we live in fear of the spammers? They are encroaching on our free expression. I certainly think that the structure of email needs to be revisited to put the prohibitions on the spammers, not the recipients.
Re:Preemptive methods (Score:2)
Re:Preemptive methods (Score:2)
For example, how does a site's webmaster (for instance - you [mailto]) seperate legitimate mail from spam. Obviously because it has to be posted on the Internet, it's going to be deluged with spam. Yet it also must be read. So your failsafe rules for eliminating spam fall flat on their face.
The real solution to spam is upgrading SMTP to require authentication before accepting mail. Booting spammers (and later, enforcing anti-spam legislation) would be a lot easier if mail headers couldn't be forged.
RBLs in Spamassassin (Score:3, Interesting)
I don't really see why anyone would use RBLs just by themselves. Personally, I have spamassassin catching the "big spams", you know the ones with webbugs, html-only, forged headers, etc. etc. I occasionally tag those as junk in my Mozilla Mail, while tagging my normal mail as not-junk. The Bayesian filter takes care of the occasionally sneaky spam. Once trained it's an awesome combination.
Re:RBLs in Spamassassin (Score:3, Informative)
ISP Volume Reduction and Defense In Depth (Score:3, Informative)
what he missed... (Score:2, Insightful)
Re:what he missed... (Score:2)
But shouldn't your URL be http://www.escarpade.org ?
-russ
Published? (Score:2)
Re:Published? (Score:2, Funny)
I realy have to disagree with this. I could "publish" the statement 'poop is healthy to eat because after eating some I got over a sickness' but that would never get published in a medical journal of any type without substantial medical inquiry to back it up.
No one can prevent you from making false scientific claims on your website, and while they may pop up from time to time in journals they are fairly rare.
-shane
Whiner... (Score:5, Interesting)
RBL's are like a fever. They tell you when something it wrong and only a dork blames the fever when the problem is the disease. Get your ISP to whack the spammer or change ISP's.
http://groups.google.com/groups?threadm=Fc6K9.262
Re:Whiner... (Score:5, Insightful)
Note that I'm not trying to claim you are dense or prove it - my point is that you could have been reached in a way that led to the same result but that DID NOT block your valid email. Is there any reason why the brutal method should be the one chosen first? Uh, any good reason - surely there are thugs who enjoy using their power to abuse others.
Not to mention that there's been more than one case in NANAE where the collateral damage was suffered by someone related to an ISP that had long ago booted the spammer but had not removed all traces. No spam flowed because of the omission, the listing was long after the spammer was removed, no risk to anyone existed. Still, the IP of an innocent party was wrongly listed, wrongly blocked, much time and energy was spent discussing it in NANAE, a person and organization that could perhaps have become spam opponents were given reason to hate the guts of spam fighters. No win of any kind I can see in that.
And, of course, the brutal blocking actions haven't ended spam, other than the occasional anecdotal victory. I ran an open relay honeypot, I saw how modern bulk spammers operate. The DNSBLs are a weak tool to deal with that. Don't take my word for it: run your own open relay honeypot. You'll quickly learn a lot about how spammers operate. All the while you'll be stopping their spam, too. Open proxy honeypot? Bless you - you'll also do wonders.
(Any of you sendmail experts able to figure out my pseudonym?)
Re:Whiner... (Score:3, Insightful)
Dense?
Why are you even mentioning the word dense?
He was a friggin customer! His email being blocked was the first indication he had that a spammer was hosted by his isp.
So what next? He asks his isp to boot the spammer. If they refuse, he doesn't want to have an acount with them anyways, so he'll go somewhere else. Seems fine to me.
It's hardly "brutal" anyways. The email bounces, it doesn't just disappear and leave him wondering why no one ever replies.
Finally, if the isp is only partially fixing a spam problem, after booting the spammer, then they're incompetent and you don't want to be working with them anyways. The ip you complain was "wrongly blacklisted" was actually rightly blacklisted. It just wasn't removed from the list, because someone wasn't doing their job.
If an isp gets a notification that an ip has been added to a blacklist, isn't it obvious that they should contact the maintainer of that blacklist when the problem is fixed? The fault in your example does not lie with the blacklist, but with the isp. If you choose a crappy isp, expect problems.
Re:Whiner... (Score:3, Insightful)
Not to mention that there's been more than one case in NANAE where the collateral damage was suffered by someone related to an ISP that had long ago booted the spammer but had not removed all traces.
That's life in the big city. Most of the time this happens when an ISP thinks that it's good enough to just remove the web site but still host DNS or mail for the spammer. This is called "spam support services" and is a no-no. Even on the rare occasion when it's something like IP addresses still showing up as being allocated to the spammer, how is anyone outside the ISP supposed to know that the spammer is no longer a customer? So many ISPs come to NANAE begging to be delisted when they have done literally nothing about their blatant spam problems that why should the one out of ten that is simply incompetent be given special consideration?
And, of course, the brutal blocking actions haven't ended spam
Oh somebody call a waaaaam-bulance. Free clue: Nothing will end spam. Even if e-mail becomes metered you will still get spam -- it will just come from the people who send you paper junk mail instead of Alan Ralsky.
Re:Whiner... (Score:5, Insightful)
RBL's are like a fever. They tell you when something it wrong and only a dork blames the fever when the problem is the disease.
It's not like any fever I've come across. For the analogy to hold, when I'm ill my entire village would get a fever, and some of the population might die, in the hope that the sound of the ambulances and funerals might alert me to the fact that I have a problem.
I'm glad you are so happy about having your reputation threatened when you have done nothing wrong. Our business is hosting websites on our own machines in a server park. Server parks are always going to be a good place for spammers to rent cheap machines, and if our clients start getting their mails bounced, they don't write to the server park owners, they cancel their contracts with us. And, no, we can't just take our servers elsewhere at 3 minutes' notice, so the RBL puts zero economic pressure on our server park (which seems to act fairly promptly on abuse compaints anyway).
RBLs punish the innocent to get at the guilty. This is wrong. The next time my business is hit by SPEWS or any other such system, I'm going to start writing pithy articles for the general press, with the aim of scaring customers away from ISPs that use RBLs, eg "Do you want your ISP to tell you what email you can read?. And I shall certainly take legal advice on whether I can sue companies who bounce my mail with any rejection message containing the word 'spam' for libel or something similar.
Re:Whiner... (Score:2)
Are you also taking legal advice on whether you can sue the /. posters who post a reply containing the word 'idiot' for libel or something similar?
Re:Whiner... (Score:2)
Are you also taking legal advice on whether you can sue the /. posters who post a reply containing the word 'idiot' for libel or something similar?
No, because none of our customers read /. :-)
Re:Whiner... (Score:2)
Ok hotshot, I've just added cyberporte.co.uk to our local RBL list and taken the liberty of posting a link (with a C&C warning) to your post on NANAE. Would you like the address of our attorney now....
This tactic has been tried several times before. There is no right to deliver (or even connect to) our or anyone else's systems. we can (and will
If you decide to read abit more you'll find that most RBL rejection messages refer to you a page, or site that is usually pretty explict in telling you why your netblock or address range has been rejected.
oh, and for the record, we make sure our users are aware that we use RBL's. Currently we have (including yours) 549 netblocks listed in our local RBL list, that's not including the 12519 that we have SPEWS blocking at the firewall... I'm not counting the 6 country wide netblocks that are banned.
The argument "Do you want your ISP to tell you what email you can read?" is sure to carry a hell of a lot of weight with joe internet user who's tired of all the MMF/Porn/Junk spam he's getting these days.
If there were any decent ways to block spam without resorting to the netblock method, We would gladly use it, but given the past attempts at such methods, I just don't see it happening.
Re:Whiner... (Score:5, Insightful)
Ok hotshot, I've just added cyberporte.co.uk to our local RBL list and taken the liberty of posting a link (with a C&C warning) to your post on NANAE. Would you like the address of our attorney now....
This is great, you've just demonstrated that RBLs are not neutral, and are driven more by a desire to punish than to solve the problem. If I ever need to send an email from that domain, I'll use one of our other smtp servers, or that of one of my ISPs, or rent a clean one, or... the problem last time was that I didn't know how ineffective RBLs are. The one thing I'm not going to do is change my server park because someone on the other side of the world is on a quixotic crusade. It's not my battle, and I object to people trying to enlist me.
Why your netblock or address range has been rejected.
In our case, it is because one machine in our 16-bit IP range had been used for spam, so SPEWS blocked 65,000 machines, each of which is administered by a different person/company. How does jeopardising the existence of my company, whose smtp server is clean, help to fight against spam? Like I said, we can't just pick up a fairly full server and take it somewhere else, so there is no real economic pressure on the server park.
Joe Internet user is tired of spam
See n previous /. discussions about this, but the (statistically) average email address gets about 3 a day. Quite a lot of /.ers say they get very few spams, and many of those who do say that the annoyance value is pretty low. On the other hand, if you are trying to buy a skyscraper (real example) and you can't get emails from the estate agent, who happens to be in a different continent, that is extremely annoying, especially if there is absolutely no reason for blocking that particular server.
Any decent way to block spam
Err, if netblock is such a greeeeat system, how come spam is increasing? Am I missing something? If there is a consensus that spam is a major problem, legislate against it. I don't have a problem with that. I do have a problem with what mrneutron calls 'collateral damage', ie people damaging my reputation to get at someone else, especially when the system obviously isn't reducing the amount of spam sent globally.
Re:Whiner... (Score:3, Interesting)
I live in a small Midwest town. There is exactly one viable option for Internet access: a small DSL/wireless ISP. If that ISP were blocked by SPEWS and I subsequently lose the ability to contact some of my customers via email, I can yell at said ISP all I want - but that's my only recourse. I don't have the possibility of switching, short of going with one of those "$6.95 per month unlimited dialup!" companies.
Where's my ISP's pressure to enforce anti-SPAM policies? They're the only game in town and they know it.
Fortunately, they seem to be as intolerant of SPAM as any other network company, and their customer service is great. That's good, because I'm effectively stuck with them.
DNSBL Fallacy #1 (Score:2)
Wrong. I use DNSBLs to block 10,000+ spams/week aimed at my users. I was using static relay REJECTs via the sendmail access file, but could not keep up with the torrent and increasing user complaints.
Aside from the obvious potential waste of time and bandwidth those 10,000 spams represent, much of it is obscene and sent by criminals.
I also track rejected mail and whitelist relays when necessary. This system works very well.
I chose not to use SPEWS due to collateral damage concerns. It's my call. If you are a postmaster, it's your call as well. One size does not fit all. DNSBLs are an invaluable tool.
SPEWS collateral damage whitelist (Score:3, Insightful)
Some experienced sysadmins do not endorse SPEWS' wholesale blacklisting of entire netblock neighborhoods. Those admins choose not to use SPEWS RBL, but may choose to use RBLs that cause less collateral damage. Some experienced sysadmins use SPEWS RBL because they do endorse SPEWS' clearly documented process which bears many similarities to economic extortion.
Many inexperienced sysadmins use osirusoft (e.g via SpamAssassin) without knowing the difference between SPEWS and other RBLs aggregated by osirusoft. Without knowing that difference, these inexperienced sysadmins unknowingly endorse SPEWS' clearly documented process which bears many similarities to economic extortion.
One answer is a SPEWS whitelist + reciprocal blacklisting. Create a whitelist of SPEWS-blacklisted-but-collateral-damage IPs which have *never* been accused by SPEWS (or other RBL) of spamming. When an ISP causes collateral damage by enforcing the SPEWS RBL against a presumed-guilty-but-never-accused IP that exists in the SPEWS whitelist, ask the individual sysadmin to use the SPEWS-collateral-damage whitelist.
If an individual sysadmin uses the SPEWS RBL but chooses not to use the SPEWS-collateral-damage whitelist, they would be endorsing SPEWS clearly documented process which bears many similarities to economic extortion. Such explicit endorsement will earn such individual sysadmins membership in an IP blacklist of "sysadmins who support SPEWS' clearly documented process which bears many similarities to economic extortion". This blacklist would then be enforced by sysadmins whose IPs are SPEWS-blacklisted-without-spam-accusation .
This unbundling mechanism provides a technical means for individual sysadmins to endorse SPEWS valuable spam-fighting contributions without endorsing SPEWS' clearly documented process which bears many similarities to economic extortion.
Long-term, the solution is pseudonymnous, non-profit TLS certificates for SMTP servers [whospams.net] with social (not economic or calendar) seniority (c.f. Apache Incubator). The economic variety exists at bondedsender.org, along with whitelist patches for popular open-source MTAs.
Helpful hint (Score:4, Funny)
To ensure that they all get this information in time for the conference, maybe you could just get a list of all the attendees' e-mail addresses and bulk-mail a copy of the paper to them?
RBL vs. DNSBL (Score:4, Interesting)
What ever you call it, if you're not running your own internal RBL/DNSBL list, you open yourself to high-capacity spammers that use newly open relays on cable modems, DSL lines, and random dialup accounts. If you run your own DNSBL list, you can easily send back an informative disconnect error message.
For some reason, Brazil and China are the biggest spammers on the mail servers I run. I blocked a whole
EFF said it better (Score:5, Informative)
Re:EFF said it better (Score:4, Informative)
The problem with the vast majority of psuedo-solutions to spam is that the promoters simply will not listen to any ideas other than the one they first thought of and they simply won't listen to people who point out that blocking good mail is a serious problem.
The 'cry me a river' response is as idiotic as it is arrogant. SPAM is a problem, failure to deliver email is a bigger problem.
That does not mean that we don't address the problem of SPAM, it just means that we have to approach the problem from both ends, identifying the good signal as well as eliminating the bad.
The MIT conference is likely to be a failure because the organizers are only presenting the tried and failed filtering approaches of the past. Those approaches are now well understood, they can mitigate the problem but can never do more than that. Filters suffer from reverse network effects, the more widely used they are the greater the incentive to program arround them.
Blacklists fail for many reasons, not least complete lack of accountability. As the paper reports the operator of one blacklist that claimed to only list open relays actually listed sites for other reasons. Ultimately a blacklist that does not have some robust accountability structure is simply a vigilante operation. Vigilantes are frequently popular with people who think they are victims of crime regardless of whether they create more problems than they solve.
The tools we need to start applying are digital signatures and email authentication in combination with whitelists. This follows sound business process, if you want to talk to someone well known their secretary will use a two step process, first ask who you are and check to see if you match the access criteria (e.g. to set up a cold call meeting with a Fortune 100 CEO you had better be a Fortune 500 CEO), then check to see if you really are who you claim to be.
Authentication and Authorization requires no heuristics and there is no feasible counter-strategy for the spammers.
I believe that the way to stop spam in the long term is to deploy signed email ubiquitously. Self signed certificates are sufficient for this purpose if we can provide a lightweight authentication via a DNS-linked PKI.
For example consider the problem of stopping spam to email lists. These are a prime target for spammers as the email server does most of the work. As a result most email lists are now filtered so that only subscribed readers can post. This has in turn been gamed by the spammers who use automated tools to scan the archives of an email list and send emails with forged headers purporting to come from another subscriber. Authentication and authorization prevents this mode of attack.
The counter-argument to using authentication is that the spammers can get their own credentials. If you spend some time analysing SPAM however you will find out that this is unlikely. Almost every spam has forged or obscured headers. While this does not prove that this is a requirement it is certainly indicative of the fact that the spamers do not want this type of visibility.
Even if a spammer can get a credential they are most unlikely to get a credential that would match my personal whitelist which would consist of the signing keys of the email lists I subscribe to and the domain names of the member companies of W3C and OASIS.
"email authentication" == "blacklists" (Score:2, Interesting)
SMTP already has a good way of authenticating who you are receiving email from. It is called the IP address of the machine that is contacting you and the IP sequence numbers of the packets that have to travel between you. All you need is a list of the IP addresses of the people who you want to receive email from and a list of ones you don't.
But, of course, this is what the current blacklists do!
Any email authentication system is going to run into most, if not all, of the same problems that DNSBLs run into. They are also going to have the problem of trying to get the entire world to change.
Re:"email authentication" == "blacklists" (Score:2)
Actually this approach is regularly proposed but actually it is more complex than that. The problem is that there is no single model for using SMTP and SMTP certainly does not provide one.
In particular a large amount of email is sent from machines that have no connection to the host name the email is purported to be from. Most unix mailers simply send the mail direct.
Any email authentication system is going to run into most, if not all, of the same problems that DNSBLs run into. They are also going to have the problem of trying to get the entire world to change.
I have helped do that before, your posting to slashdot is demonstration.
What is needed is a scheme such that the incentive to opt-in is greater than the cost of opting in for all network sizes. I believe that there are ways of promoting the authentication approach that have this property.
The problem with network effects is that they cut both ways. Whenever someone talks about viral marketing I short their stock unless they can show that there is a significant benefit to opting in before the network exists. Otherwise your 'network effect' is really a chicken and egg problem.
Dream on... (Score:2)
In short, nobody would slow down the spammers and our inboxes would be flooded by spam, even if the filters were 99% effective.
The only way to reduce the amount of spam you receive is by reducing the amount of spam being sent.
Personally I use the SBL [spamhaus.org] and DSBL [dsbl.org] lists to block mail from known spammers, their supporters and open relays and open proxies.
Spammers have a right to free speech, but they have no right to free speech on my property. If they want to advertise, let them setup a website I can view when I want to. Free speech is about speech in public areas and is not relevant when it comes to private property. Free speech does not trump private property rights. If you think free speech does apply to private property, send me your address and I'll organise an industrial and hardrock concert in your garden.Having said that, I think it would be good if every user could choose for him/herself the filters used on his/her mailbox. If only because the users are likely to choose much more agressive filtering than ISPs could ever setup by default.
Open Relays (Score:2)
Has he completely missed that point?
Oh, well. If I'm to replace RBL type filtering with another anti-spam mechanism, there's only one I'd consider. That one is going complete pre-mail opt-in, in which case he's far more screwed than he is today. Live with the trouble of RBL's and get your ISP to do the right thing, or get a far, far more draconian solution.
Re:Open Relays (Score:2)
There are surprisingly recent OSes that stil can't limit relaying to specific hosts; it's all (open) or nothing (closed). One example: OpenVMS. Until TCPIP v5.1 last year, it didn't have this capability. Of course, the excellent third-party Multinet has for some time.
Re:Open Relays (Score:2)
If an OS is not secure enough to be put on the big, bad, internet, it should be put behind one that is. Obsolete and/or deficient software is a reason for firewalls and proxies, not for being a menace to the network.
Re:Open Relays (Score:3, Insightful)
I'd have to say, yes.
Personally I use Spamcop's [spamcop.net] RBL and reporting service. I check the held mail page a couple of times a day. I have yet to see a legitimate mail be blocked and it's reduced the number of spams a day I get from hundreds to 2 or 3.
Maybe some RBLs still work the way the author decribes but from what I'm hearing that's not the way many work now. Now it's more like a reporting user recieves a spam (hopefully very near the start of the spamming run) and reports it. The reporting system works out the most probable source and lists it (due to the fact that spoammers often move within a netblock the netblock rather than the individual IP address has to be blocked for the RBL to be effective), the system also mails the admin address for the appropriate domain (and any listed interested third parties) with the information required to identify the spammer and asks them to deal with them. That IP address is also monitored by the RBL. When the spammer stops sending spam or the administrator informs the RBL operator that they've dealt with the problem the netblock is taken off the RBL.
If the mail system administrator are on the ball and not asleep at the switch there's no reason why the total time from a netblock being entered into an RBL to being removed need be more than a couple of hours. If they're crap at their job or beligerant then they don't deserve honest customers.
The complaints made by the author of this paper are very reminisent of some of those I've seen on antispam/pro-RBL mailing lists from spammers who've had their spams stopped by RBLs. Draw your own conclusions, but I'm inclined to go with "If it looks liek a duck, it quacks like a duck nd tastes great with plum sauce...".
Stephen
One possible solution ... (Score:3, Informative)
There is a simple web based front-end that allows users to add and modify rules for accepting or rejecting mail based on a variety of factors - all saved in the datbase. Things like checking the subject, to, from, or the body of an incoming email for the presense (or lack) certain strings is a simple example.
All of this is done is Perl using Mail::Audit of course. I know there's Spam Assassin, but this was a little more fun (and customizable) for us.
The final check is the Realtime Blackhole List. When we first implemented this solution, we noticed in the logs that almost everything was on the RBL (even mail from yahoo.com). In fact, our own server was on the RBL. We'd never sent spam before, but I'm sure our relay was open at one time or another.
Since the system is configured to look for "accept mail" rules first, the solution came down to adding "accept" rules for pretty much everyone we knew, so that mail from known parties would be accepted even if on the RBL.
So now I get no spam at all - ever. I get very little mail at all in fact. It's really analogous to having an unlisted phone number. It's not the perfect solution by any means, but I'll take it any day over slogging through literally hundreds of spam mails every day ...
The Author misses a few points (Score:2)
_NOTE_ IOHE RBL's in on a single mailserver rejected over 70% of all incoming requests. It took more than 90 days before we had our first complaint from using that RBL. Think of all the mail that didn't get delivered and the saved disk space, system resources et al.
2. Any RBL used is the choice of **insert org here** and not on the people sending mail.
_NOTE_
Very often the people charged with running **insert org here**'s mail server have been told "you must reduce the amount of spam I recieve". For many RBL's are an affective way of doing just that.
3. If the authors point about the legality of relay testing can in fact be upheld in a court, then ALL SPAM is illegal. Since this has not been found to be the case in US courts, then relay testing must be legal. (i.e. 18 USC Sec. 1030 (a) 2 (c))
4. If the Sherman anti-trust act can be applied here then it would also apply for spammers. SPAM is more in violation of the anti-trust act than RBL lists. (Why? because it prevents the delivery of legitimate e-mail, thus purposely causing delays and interfering with commerce)
Other solutions mentioned are worth merit, but it should be pointed out that these solutions are most often used and are most effective when used in conjunction with RBLs. A better solution would be to fundamentally change the way e-mail delivery works. DJB (http://cr.yp.to) had an idea some time ago where the cost of e-mail sent is born by the sender, not the reciever. That system may be the best bet. The ability to then block senders becomes a lot easier and your ISP doesn't have to do the very much "heavy lifting". The spammers get to do it. I like that idea better.
cluge
Re:The Author misses a few points (Score:2)
We've had two collateral complaints, one from a vendor and one from a client.
The vendor I understand; they're a marketing concern and they have been dipping their toes in "direct email marketing" (highbrow spam?), but they do it from their business netblocks.
The client suprised me; a household name in the home products business -- you'd all recognize their name. But they're one of those "smart" businesses that buys low-budget ISP service, takes whatever 'free'
But other than those two, I have gotten zero complaints. It's an imperfect tool (I still get a dozen or so per day), but easy to implement and as long as the people making the list are active and flexible, a valuable one.
Bollocks! (Score:5, Insightful)
Summary: someone tries to send email and finds that they're listed on SPEWS. They complain because "we're not an open relay", without figuring out just why they're on that list. Almost invariably, they're on the list because their ISP persistently ignores spam complaints and prefers spammer money to honest customer money. I think there's been about two or three actual mistakes in the SPEWS listings in the year or so I've been following NANAE. Otherwise, it's all been a legitimate extension of the block because the ISP knowingly ignores complaints and supports spammers.
Spam is theft. Theft of Bandwidth, theft of service and theft of time. It's that simple. Spammers are thieves. ISPs which support spammers are thieves. Soon, they'll be blocked from the public internet for anti-social behaviour. After all, if your local bargain supermarket ignored the thieves stealing 20% from every transaction you make with them, will you go back?
Many South American and Asian ISPs are blacklisted because they were quite happy to spam everyone when they could steal bandwidth and service from other ISPs. Now that they're blacklisted, they're whinging and moaning about 'freadom of speach', interference with interstate commerce, and other such bullshit.
It's about none of these things. Blacklists are about protecting your network from a Denial of Service attack by spammers.
People who complaing about RBLs (OR DNSBLs, to be more accurate) are missing the point. They should be complaining about spammers who think it's acceptable to steal my bandwidth and your bandwidth to advertise their product..
dave "the only good spammer is a rotting corpse, dangling from the noose"
Re:Bollocks! (Score:2)
While spammers certainly are not keeping ISP's alive,
You pointed out the difference yourself. Your supermarket pays for its flyers to be delivered. Spammers steal resources from their recipients in order to deliver their ads.
Spammers are thieves because of the way they deliver their ads. Sometimes they're also thieves because they're cheating scum who deliver fraudulent scams, but that's beside the point.
Re:Bollocks! (Score:3, Informative)
Contrary to what many anti-spam activists would have people believe, you are correct. Spammers are not thieves. They are, however, engaged in an unethical form of guerrilla marketing which has the net effect of shifting costs of advertisement to the consumer, rather than to the advertiser. Much like the RIAA labels people that infringe copyright as "pirates" and "thieves", to little effect, calling spammers "thieves" is probably over the top and unlikely to bring positive change.
The key difference you've missed is where the costs are borne. My company pays $650 a month for our T-1. By 9 AM this morning, we had received over 11,000 attempted emails. We have 300 employees. Of those 11,000, roughly 200 were legitimate mail. The rest were spam, double bounces, or roughly 4,000 attempts in nine hours to send mail to addresses which do not exist in our domain. We used to accept these and send bounces directly from our Groupwise server; I put Groupwise behind a firewall and Postfix mail relay shortly after I was hired here, and noticed that in two weeks we had over two gigabytes of double-bounces sitting in our queue. Yes, I use RBL, Anomy, and SpamAssassin. Nevertheless, the amount of time that I have had to spend to limit the problem to manageable levels that don't drive us out of disk space and bandwidth has cost my company dearly from payroll. I can drive past billboards and ignore them. I can choose not to listen to the radio or watch television. I don't miss much by not watching TV or listening to the radio, and thankfully any important global news I get relayed through my co-workers. In today's world, however, it would be extraordinarily difficult to decide to not use the telephone, or, if you conduct a great deal of business using electronic mail, to suddenly decide to stop using the medium entirely.
I'm not saying you are wrong, but it seems to me that both the "spammers are thieves" and "spammers are not thieves" arguments are not quite hitting the mark. Whether unintentionally or intentionally, a single unsolicited commercial email can end up collectively costing the world a great deal of money. It seems that the best analogy I could use is that spammers are like cigarette smokers. A smoker's behavior hurts only themselves, but the secondary aspects of their behavior (second-hand smoke) impact the health of others, and so that portion is regulated. It's difficult to find a public building in the U.S. these days that allows smoking due to the known, unhealthy side effects. But it took the human race hundreds of years of dealing with "annoyance levels" of the problem before coming face-to-face with the predictable health consequences of the smokers' actions.
No offense meant to smokers! I know it's a hassle to have to go outside when it's sleeting and windy in order to find a place to smoke. Spammers, also, are exercising their right to free enterprise and free speech, but, ultimately, I think spammers will find themselves in a similar regulatory position, that they must practice their craft only in designated, acceptable areas, and that spamming outside of those lines will have significant legal repercussions. Digital signatures are part of the solution, as are whitelisting and blacklisting. If spammers can be forced to operate legitimately, using only legitimate information so that they can be contacted and held liable for their actions, it would be a truly enormous step in the right direction. I don't think that part will happen through legislation, but through very large installed bases of users beginning to use mail platforms which transparently implement this kind of functionality...
Can somebody explain how (Score:3, Insightful)
and
Scalable (resources)
Aren't mutually exclusive?
Simple (Score:2)
Instead of running your mail server on a PC running Linux or a low - mid range Sun/IBM/HP/whatever box you have to run it on a Beowulf cluster of E10,000/s390/V-Class/Indian Supercomputers [slashdot.org]. Perfectly scalable, it's just that your hardware and support costs have gone up by several orders of magnitude.
Stephen
Re:Can somebody explain how (Score:2)
Let's suppose that it stays a constant 140,000 users, with no gain or loss.
How long before they have to upgrade the mail servers?
Re:Can somebody explain how (Score:2)
My SPTP greeting (Score:2)
220 mail.XXXXX.com: By connecting to this host
220 you agree to be open relay tested by
220 njabl.org. You also agree
220 to only send traffic that complies with our
220 AUP and our providers AUP. ESMTP
Seeing that your server must connect to mine first, I wonder which contract will be upheld in court?
cluge
Re:My SPTP greeting (Score:2)
Re:My SPTP greeting (Score:2)
-russ
Oh, boo hoo. (Score:2, Interesting)
So, this guy has a problem: his mail server is blacklisted because it is part of the same netblock as a spammer.
So, rather than switching to a responsible ISP that doesn't allow spammers on its network, he writes a long winded whine about how to solve the "problem" of RBLs (although, mind you, he doesn't give a solution, just what he thinks should be part of the solution).
What he doesn't seem to understand is that the blacklisting of entire netblocks is only done as a last resort when ISPs refuse to get rid of spammers on their networks. It is a punitive measure to try to force the ISP to act.
While I applaud this guy for doing his research, I think he is misguided and even narrow minded. If you are part of the 'collateral damage' because your ISP allows spammers on its network, do the right thing and take your business elsewhere.
Big deception ... (Score:2)
The only way to reliably and permanentely stop spam is to to make it unprofitable. Since spamming have near-zero cost, anti-spam measure must attack the revenu stream of spammer. The revenu stream is people buying into spam. Thus having less people buy into spam is the only effective anti-spam prevention measure. All the rest is just Band-Aid in a loosing battle.
BTW, this is the same thing with tele-marketing, junk fax, etc.
Re:Big deception ... (Score:3, Insightful)
The problem is that the relevant "people" are not necessarily the ones stupid enough to respond to spammed come-ons. Even in the (unattainable) case in which nobody ever responds to spamvertising, spammers will still make money.
Large-scale spammers don't sell their own crap; they sell the "service" of spamming advertisements for other people's crap. Even if nobody responds to the spam, the spammer still has the money. Eventually, some of the clients get tired of flushing their money down the toilet, but there will always be customers for the spammer's snake-oil pitch.
The two problems (which impact more than e-mail) (Score:5, Insightful)
(2) Your e-mail system administrator (and mine) need to keep beefing up the servers because the sheer volume of e-mail is growing so quickly.
To a first approximations, filters solve (1) but not (2), and black hole lists solve (2).
whirlycott summarizes the problem with (2) in two words: "collateral damage." How much of the e-mail network do we need to destroy in order to save it?
We need to move past first approximations. We need systems that work at the server level, but that somehow address the problems of collateral damage and false positives.
This is only the tip of the iceberg. Any network messaging medium is vulnerable to abuse by spammers. The problem started with Netnews, it continued with e-mail, it's happening now with instant messaging. We need at least high level solution that helps solve the problem regardless of prototcol.
I wish I had one.
Moving Beyond SMTP is the Answer (Score:5, Insightful)
The problem, as I've said here before, is SMTP itself.
The RFC pretty much states that to be compliant, you have to accept the mail as it is presented. Can't achieve accurate or trusted reverse name lookup information on the sending system? Well, that's tough, take the mail (read this for yourself).
This problem stems from when systems on the Internet were inherrently trusted. That's not the case any longer, and it's time for a new mail transmission standard.
For starters, it should allow system administrators the ability to give priority to systems that can present some form of credentials. SSL or keyed encryption, whatever the standard is, it will permit systems to give totally trusted access to systems that meet the specific security and trust guidelines of the receiving system, not the RFC (times have changed, tough).
Those systems that do not meet minimum trust levels will either have to clean up their act or take the time to contact the remote system to figure out the issue.
It won't stop spam, but it will go a long way to slowing it down and possibly providing some secure method of mail transport in the process.
Re:Moving Beyond SMTP is the Answer (Score:2)
All "fixed" systems imply that the only people that you want to get email from already have some sort of "trusted" email system. That doesn't exist in the real world and there is no way to create one now. just like there is no technological way to keep people from putting stuff in your letter box, there is no way to keep others from putting stuff in your email box. If you lock it down, then there is a chance that people that you want to try to send you a message won't be able to. The US post office solved the problem with a law with a stiff fine. Spam will only stop when that happens and lots of people get hit hard by it.
my 13 and a half cents (Score:3, Insightful)
My server, my rules (Score:4, Insightful)
One proviso: if anyone complains, I will look at it.
RFCs require that one accepts mail for postmaster@domain.com and from the empty envelope sender. Since I do this, I believe I am fully RFC compliant.
So stop whining about DNSBL. The problem is wider than that, and will not be solved by getting rid of DNSBL. The system isn't perfect, but that is not the issue.
In Defense of RBLs (Score:5, Interesting)
Many have changed how they use RBLs - instead of simply rejecting they send a reply asking for confirmation the sender is a real human. If that confirmation is made the original message is delivered. That seems to be simple, straightforward, and capable of reducing collateral damage to a very low level. It even has intelligence behind it.
I advocate relay spam honeypots (and open proxy honeypots - move with the times, keep up with the spammers). The white paper doesn't even mention these. The WP has the section asking if open relays are necessary. Well, no, they probably aren't. Is there a point? For how many years has there been an effort to secure open relays? Has it succeeded? The fact is that they are there - asking if they are necessary may inform you but it doens't change the situation in any useful way.
For all these years the spammers have been given free access to the relay level - there's a self-satisfying division into the secure systems run by the wise and the open relays run by inept administrators. that division allows the operator of a secure system to condemn the operator of an open relay with confidence - he can strut. Yipee. As a spam-fighting tool it's a close to a complete bust. Well, yeah, lots of open relays have been secured. BFD - there's still enough for the spammers, and RFC 2505 said it would be this way. Yo: RTFM (in this case RTFRFC.)
You want to hurt the spammers? OK, hurt them. It's not like you have to go out of your way - accept and deliver one of their relay tests and the chances are excellent they'll send you spam that you can discard. That's still a secure system, but it has teeth instead of gums.
There's all these people falling over themselves devising elaborate filters. If you simply open up a relay enough to accept the spam but not deliver it there's no filter needed - a non-mail-server system that receives relay email receives close to pure spam - you will never get a filter as selective as that. Accept and deliver the relay tests and you have screwed the spammer. I won't even enumerate all the ways he is or can be screwed but there's a bunch.
If 5% of the Windows systems with network connections ran Jackpot then spam would be dealt a mortal blow:
http://jackpot.uk.net/
It isn't hard, and it does tremendous good. Check it out.
Working with the RBL idea. (Score:2, Interesting)
Alternative ... (Score:2)
If he's annoyed, then it's working. (Score:5, Insightful)
Author seems not to get it (Score:4, Insightful)
Obviously, if a huge amount of spam is coming from a huge amount of servers in a country, a huge amount of servers in that country are going to get blocked.
How about we drop the sensationalism here?
It's not some conspiracy to block all mail from Asia.
Look, maybe some people need to get mail from Asia, but I don't have any reason to. I'm not obligated to let anyone on the internet contact me at will. I can pick and choose who to block/accept at will. If people in don't want their servers to get blocked, maybe they should deal with their spam problem. I don't have time to fix it for them.
Look at it this way:
The internet is this huge shared network. It has a finite amount of bandwidth and it works because everyone carries data to its destination.
The question here should not be if any nodes should ever get blocked. The question should be: How much junk traffic should a single node on the network have to generate before it happens?
At some point you have to start blocking people. If I start DOSing an email server (almost what spam is), I can expect to have my traffic blocked at some point. Maybe I have to send a million junk messages, maybe a billion, but at some point it's costing too much to carry and process my traffic. Yes, bandwidth costs money. That's just the way a system like the internet has to work. There have to be mechanisms in block to handle the case were a node starts misbehaving. One of those mechanisms has to be dropping traffic from that node.
Carrying junk traffic costs money. Filtering costs money. At some amount of traffic, the cost becomes too high, and you have to block the traffic. Think of it as a signal to noise ratio. There always needs to be some number, at which you pull the plug, because the data isn't worth dealing with anymore.(And filtering it is too expensive)
Any time you share something you're going to need the ability to do this. If I start driving in the middle of a two lane highway, I can expectect to get pulled over and have my license revoked (eventually). It should be. I'm messing up things for everone else and the sensible way to fix it is to remove me.
How to really stop spammers... (Score:2)
and a potential solution. Recently, I read an interview with a spammer. She said that she could make a profit with a response rate of
email that isn't (Score:2)
I see spam as being an email protocol problem as much as anything else. Too easy, too easy for bots to get addresses now or guess them. The spammers are like drunk drivers on their 15th DUI, lost their license long ago, but are still on the roads. the deal is, we don't really have any road control, there's no traffic cops (and don't want them thankew). So, we need "new roads" that people can use to send "electronic mail" to each other that ISN'T something in common use yet. It needs to be setup so that only people that are trusted by anyone "you" can use. It's this name@someplace.com. See that @ symbol? How about a replacement, and some sort of new way to start "electronic mail" from scratch and build trusted private networks for correspondence, and something that didn't use that @ symbol?
Yes I know this is probably naieve, don't know how to describe this better though. Is there such a critter in existence? If I was living in a floodplain, and had to constantly add to the sandbag piles to keep the water out, and it still leaked all the time, well, I'd just move someplace better. I see the email problem now to be just that, never ending war with spam, anti spam, anti anti spam, anti anti anti spam, etc. I'd rather scrap the whole email thing as it stands and start over with something "better", move OUT of the floodplain. So, I'm asking, where's the "high ground" to move to?
RBL's can help spammers (Score:2, Interesting)
Along comes one of the RBL's and test my site. So far so good. But instead of sending an email to postmaster@the-blocked-site they post my IP and a sample of how to use my system to forward spam.
Several days later, on a weekend of course, the spammers started using me. The spammers aren't stupid either. They use the RBL's to find new relays.
I have fixed the problem. However, one small email notification would have prevented several hundred thousand spams. I wonder how many sites have been used this way?
The whole of his argument (Score:2)
-russ
Collateral Damage? (Score:2)
My ass
Once your ISP allows people to test then maybe you'll get off the list of IPs that block open relay testing.
RBL results [osirusoft.com] : 127.0.0.4, Test blockers: Null routed all access
So, exactly why is you, or your ISP afraid to be tested? Oh I see, your stance may be relay testing may well be illegal. Well tough. If someone turns up at your turn and asks for entry you would ask for identification. Your IPs stance in banning relay check connections is equivilant to not producing identification, but demanding entry anyway.
Until you can prove that you're not a spammer then don't expect your RBL status to change, and for those people that block on that status, you won't get through.
Collateral damage is part of the design (Score:3, Interesting)
The author of the article is yet another person who misunderstands the problem. The problem is not how to prevent the delivery of spam; that has already been solved. The problem is how to get the ISPs hosting the spammers that continue to eat up our bandwidth to disconnect them from the network. Decent ISPs will just do that upon the discovery they have spammers. And it is acceptable to slap their hand once or even twice, but three spams and you're out. The problem is many ISPs are not decent at all, and will only act upon a financial incentive. Blocking the whole ISP is what is required. DNSBLs such as SPEWS are doing that incrementally with the intent to minimize the number of others affected for long enough to show to the ISP that they had better get rid of the spammers. At this point most ISPs will realize they will lose customers in the future, and will get rid of the spammers. A few will be stubborn, and will eventually have their entire address space listed. Not only do we not want mail from spammers, we don't want mail from anyone who supports spammers. And if you are paying money to an ISP who runs in turn is providing services to a spammer, then you are indirectly supporting spammers through financial benefits, such as the ISP offering the spammers lower rates through economy of scale. And do not forget that if you are doing this, that you and your ISP are benefitting off the costs incurred by others. All this article is, is a reflection of frustration by an individual who just doesn't get it, that he needs to either turn his ISP around to be a decent member of the internet community, or he needs to switch to another ISP. It looks like a lot of work went into it, but the premise being all wrong, the article is worthless and offers no solutions.
My reply to the RBL document [link] (Score:3, Interesting)
Here [ipal.org] is my reply to the RBL document. I felt it better to put the reply in proper context, so I made it by red markup on the original. Feel free to make further comments that way yourself, in this Slashdot thread, or in the mailing list the document identifies.
Spam from a large ISP's point of view (Score:3, Insightful)
1) John SneakySpam needs a new ISP because he's been thrown off of {insert other large ISP here}
2) John contacts Sales and waves a decent sized monthly contract at Mary Salesgal.
3) Mary finalizes the deal, collects her commission check and then skips off to make her next deal. (No vacation - the market is tight and any income is good income for Mary)
4) John SneakySpam being a *really* smart guy becomes his own ISP and resells his service to
5) Matt SpamSneaky sets up his spam services and starts selling MomPop Inc. that he can reach millions of people for almost no cost.. say $500 per mailing. MomPop Inc. is pleased to spend $500 on advertising that'll reach millions. It's cheaper than the $5000 that the local ChroniTimes would charge for a 2 inch ad on page 39 of the Home/Life section or the $800 that the local "HangMyFlyerOnTheDoorknob" company charges to put out flyers in a neighborhood.
6) Matt SpamSneaky waits til Friday afternoon - around 6p Pacific Time (after all the folks at the ISP have gone off to drown their sorrows in the chemical libation of their choice) to begin his "directed advertising"
7) Around 2a Pacific Time on Saturday the postmaster and abuse boxes at directedmail.grp start getting the complaint messages.. but wait.. these mailboxes either don't exist or go straight to the bit bucket.
8) Around 2:01a Pacific Time on Saturday, the automated programs that watch for Spam start looking up the ip addresses and netblocks and sending complaint messages to abuse and postmaster at "flightfromEgypt.net" about the issue.
9) Around 2:35a Pacific Time on Saturday, the members of the Abuse department and/or the people who watch Postmaster return from the night of libation/comparison of who's supervisor/director/vp should end up at the bottom of Lake Mead first and before heading to bed log in to review the boxes to see if they should libate more or not.
10) Around 3:45a Pacific Time on Saturday, the Abuse and/or Postmaster folks finish ranting and screaming about the individual in Sales who just made their living hell more painful... and also explain to the very nice people with the bullet-proof vests and shiny badges that you were just upset about something at work and if the neighbor really didn't like profanity, why did they subscribe to the Spice channel?
11) Around 4:30a Pacific Time, the Abuse team attempts to contact John SneakySpam's company and/or sysadmin to let them know there's a problem that needs to be addressed. Ah, but their admin doesn't work weekends and you don't have another contact number or it's busy/doesn't answer/goes to voice mail. And you can't pull the plug on their system - that pesky contract they signed that gaurantees uptime and network connectivity and stuff. So you're stuck until Monday. Or Tuesday if it's a long weekend.
12) First thing next Business Day, you contact John SneakySpam. John says "hey it's one of my downstream customers - let me get ahold of them and tell them to stop." You wave the TOS, AUP and the fact you have a big backyard and a shovel in his face. John waves his contract back in yours. You contact Legal and Legal reviews John's contract and his monthly billing and says give him a warning.
13) Repeat steps 6-12 at least twice more. 3 strikes rule and all.
14) Legal now takes over. Jason LegalBeagle contacts John and says we're going to have to term the contract and John says "It was a downstream customer, let me term my contract with him and this won't happen again"
15) Repeat steps 6-14 at least once more, possibly up to 3 times.
16) Legal now is ready to toss John et. al. out and deal with the contractual issues this entails. Not to mention John is behind on paying his bills. So out goes John.
Total Time: Anywhere from 1-4 months
Meanwhile, to the outside world, it appears that you aren't being "responsive". Just an alternate point of view...
Read the mail (Score:2)
Re:you get what you pay for (Score:2)
Re:you get what you pay for (Score:2)
For this reason, my email is configured not to download HTML and is blocked from accessing any ports aside from POP3 and SMTP by my firewall just in case...
Re:you get what you pay for (Score:2)
Re:you get what you pay for (Score:2)
Re:There is no spam problem. (Score:2)
This way, perhaps, we can get Ralsky in jail ... (Score:2)
So what you are saying is that we can get Ralsky put in jail, which will become his new company H.Q.
However, if he makes enough money spamming, we could use the money to make bigger jails so that we can imprision the other spammers
Re:This way, perhaps, we can get Ralsky in jail .. (Score:2, Interesting)
http://www.freep.com/money/tech/mwend22_2002112
Just try to get the ISPs in Dallas to act with integrity, seek out the spam servers (they should leap out in any traffic analysis) and shut them down. The DNSBL's are close to useless here, it seems. Ralsky spams from Dallas using asymmetric IP routing: he spoofs the IPs of dialup systems from the servers. If anything gets nuked its the dialup account, not the high-speed-linked system that actually sends the spam (the dialups only receive the return packets from the systems that receive the spam.)
(Maybe Ralsky spams from Dallas differently - earlier this year he surely was using the asymmetric IP approach. Ralsky did lose throwaway accounts on three different ISPs because of the actions of one honeypot operator: Michael Tokarev in Moscow. Unfortunately Michael shut the honeypot down in July:
http://www.corpit.ru/cgi-bin/h0n5yp0t )
Getting Ralsky in jail wuld be nice, and he deserves it. Before that it would be effective to so disrupt his spam operation that he experiences a negative cash flow. Honeypots are the way:
http://jackpot.uk.net/
Setting up the honeypots is the first step. Once enough are intercepting Ralsky spam notify the spam advertisers that huge amounts (don't tell them the actual amount) of their spam is being intercepted. Get them in billing disputes with Ralsky. If they also see sales going down (as they should) they may have a flash of intuition that tells them spam doesn't work any longer, and the interceptions are the reason.
But don't stop doing what works for you, of course - add in the honeypot for its effect on the spammers beyond your own system.
Re:This way, perhaps, we can get Ralsky in jail .. (Score:3, Insightful)
SYN from the dialup account.
SYN+ACK from the helpless email server back to the dialup account. Dialup account now has observed both sequence numbers.
ACK from the dialup account, and the SMTP transaction begins.
As sending mail consists mostly of uploading, upload packets to the server are forged from the high-speed account to the server. The dialup account only needs to receive the ACK for the sent data, and the SMTP responses from the server. The spammer uses both the dialup and the high-speed accounts in tandem to keep the connection alive, in effect intentionally hijacking his own TCP connection.
Very clever! The spammer must have had some help in setting up a scheme like this. I don't think he'd be smart enough to write the software on his own.
Re: (Score:2)
Re:Preventing Spam through false positives... (Score:2)
Re:Spam? (Score:2)
I can sympathize with paying the bill and the slow connection, there are solutions though. Building blacklists and te vigilantism that goes with them is nothing more and digital road rage.